fix: reject malformed email addresses at signup

[xpoes123]

The signup route stored any string as an email address without validating its format. This adds a lightweight format check so obviously malformed addresses are rejected before they reach the database.

Problem

In routes/auth/signup.js, req.body.email was passed directly to createUser with no validation. A malformed email written to the database would cause silent failures downstream — password reset and email verification would silently no-op because the address is unparseable by the mail transport.

Changes

• Adds validateEmail(email) to server/authentication.js: a permissive user@domain.tld regex check (/^[^\s@]+@[^\s@]+\.[^\s@]+$/) that returns false on obvious format errors.
• In routes/auth/signup.js, applies the check before saltAndHashPassword and createUser. The guard fires only when an email is provided — absent or empty-string emails pass through unchanged, so accounts that sign up without an email are unaffected.
• Returns HTTP 400 on an invalid email so the client can surface a useful error.

Risk & testing

No existing signup flow is broken: the validation is conditional on a non-empty email value. The regex is intentionally permissive to avoid false rejections of valid but unusual addresses. Mirrors the existing validateUsername pattern in the same file. node --check passes.